EUVD-2026-66585
GHSA-4qjp-chcx-vxh6
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Local trigger via ovpn peer/module teardown (AV:L), narrow RCU race (AC:H), needs privileges to drive ovpn/module state (PR:L); impact is a use-after-free crash so A:H, C/I:N.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
ovpn: finish crypto callback cleanup before peer release
Crypto completion callbacks hold both key-slot and peer references. The peer reference pins the netdev, and dropping the last peer reference can let netdev unregistration and module removal make progress.
Do not release that peer reference before the callback has finished its own cleanup. If ovpn_crypto_key_slot_put runs after ovpn_peer_put, it can schedule an RCU callback backed by module text after ovpn_cleanup rcu_barrier has already run. The TX error path also freed the remaining skb after ovpn_peer_put, leaving callback cleanup outside the peer/netdev lifetime window.
Release the key slot and free any remaining skb first, then drop the peer reference as the last callback action.
AnalysisAI
A use-after-free / lifetime race in the Linux kernel's ovpn (in-kernel OpenVPN data-channel offload) module lets crypto completion callbacks outlive the peer and netdev they depend on. Because the callback holds both key-slot and peer references, dropping the last peer reference too early can schedule an RCU callback backed by already-freed module text after ovpn_cleanup's rcu_barrier has run, corrupting kernel memory during peer teardown or module removal. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires the ovpn (in-kernel OpenVPN data-channel-offload) module to be built and in use - systems without ovpn are unaffected. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H = 9.8) is inconsistent with the described mechanism and should be treated as an automated over-rating. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A local user or process able to bring ovpn peers up and down (or an administrator unloading the ovpn module) triggers rapid peer disconnects while crypto completions are in flight, winning the RCU timing window so a callback fires against freed peer/module memory. The result is kernel memory corruption-typically a crash (DoS), with theoretical escalation potential inherent to a use-after-free. … |
| Remediation | Upstream fix available (stable commits a3a67649, 4b0de8be, 9e163917); update to a kernel that includes them - per EUVD data the corrected stable builds are 6.18.46, 7.1.10, and 7.2 or later, so apply your distribution's kernel update carrying these commits. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all systems with the ovpn kernel module active using lsmod | grep ovpn and determine kernel versions across your fleet. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today